In the UK, and I presume the EU also, the fines for losing customer data are set as a % of company annual worldwide turnover.
https://ico.org.uk/for-organisations/law-enforcement/guide-t...
https://ico.org.uk/for-organisations/law-enforcement/guide-t...
They're not fines though if no money changes hands.
So far very few if any of these supposed penalties have actually been paid.
There have been a few good articles published about the total Euro amount of "penalties" and actual enforcement actions, and the ratio is something like 100:1 or worse.
To me, that's still in the "cost of doing business" territory, not the "punishment" territory.
Wait until you see what kind of reaction 40% gets! Existential threats will be the only things that work.
We should consider the maximum that has actually been issued, than subtract some off of that. You also have to subtract out all of the money they saved over the years of reduced investment into security.
I think that lands us squarely back into "cost of doing business" land.
the EU needs to tack another 0 to these percentages if they want to see movement.